Notifications
Clear all
Topic starter
06/09/2026 6:20 pm
TL;DR: Credential reuse, third-party access, and zero-day exploitation dominated FireCompass’s weekly incident roundup, which covered DraftKings, Kido International, Discord, and Harvard University across 7-13 October 2025. The pattern is consistent: weak authentication and delegated access continue to outpace conventional monitoring and response models.
NHIMG editorial — based on content published by FireCompass: Weekly Cybersecurity Intelligence Report, Cyber Threats & Breaches, 7 Oct to 13 Oct 2025
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
Questions worth separating out
Q: What breaks when application security controls are too weak against credential stuffing?
A: The application starts treating automation as legitimate traffic, which lets attackers reuse breached credentials to take over accounts at scale.
Q: Why do support accounts create outsized breach risk?
A: Support accounts often reach multiple customer-facing systems and may bypass normal least-privilege controls for convenience.
Q: What are the signs that vendor access governance is failing?
A: Common signals include long-lived support privileges, unclear ownership of vendor accounts, inconsistent offboarding, and access paths that reach multiple systems without segmentation.
Practitioner guidance
- Strengthen adaptive authentication for high-risk logins Add risk-based MFA, velocity checks, and anomalous user-agent detection to customer and privileged authentication flows so reused credentials are less likely to succeed.
- Tighten third-party support access Inventory every vendor identity that can reach support, admin, or customer data systems, then reduce scope, shorten approval windows, and enforce explicit offboarding.
- Contain internet-facing application exposure Map all public-facing business systems, prioritise those handling finance or identity data, and define emergency patch and compensating control playbooks before the next zero-day lands.
What's in the full article
FireCompass's full analysis covers the incident detail this post intentionally leaves for the source:
- IOC-level authentication log patterns and suspicious login indicators from the DraftKings case
- Named remediation actions taken after each incident, including vendor access revocation and MFA enforcement
- Technical indicators tied to the Oracle zero-day chain, including exploit paths and request patterns
- The full per-incident chronology across credential stuffing, third-party compromise, ransomware, and zero-day exploitation
👉 Read FireCompass's weekly cybersecurity intelligence report on recent breach patterns →
Authentication weaknesses and supply chain risk: what teams need to act on?
Explore further
06/09/2026 6:21 pm
Authentication failure is now a recurring breach pattern, not an isolated tactic. The DraftKings incident shows how quickly automated credential reuse can succeed when login defenses treat attacks as ordinary user activity. For IAM teams, this is a reminder that authentication telemetry must be operationally meaningful, not just logged. Adaptive controls and credential intelligence are now baseline expectations, not hardening extras.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: What should security teams do when a public-facing application is exploited?
A: They should contain the exposed system first, revoke or restrict any related service accounts, and determine whether the application can reach identity, finance, or support data. The key question is not only how the flaw was exploited, but which accounts and downstream permissions it could activate.
👉 Read our full editorial: Authentication weak points are driving this week’s breach wave
